The vulnerability CVE-2026-14638 affects itsourcecode Hospital Management System 1.0. It is caused by improper sanitization of the 'editid' argument in the /patient.php file, enabling an attacker to perform SQL injection. This allows remote attackers to manipulate backend database queries. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification within the Hospital Management System. The impact is rated medium based on the CVSS score and the described limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected endpoint and applying web application firewall rules to detect and block SQL injection attempts may help mitigate risk.